Client-side encryption in a deduplication backup system

ABSTRACT

Client-side encryption in a deduplication backup system. In one example embodiment, a method includes a backup phase in which various steps are performed for each allocated plain text block stored in a source storage. One step includes hashing, using a first cryptographic hash function, the plain text block to generate a first hash. Another step includes hashing, using a second cryptographic hash function, the first hash to generate a second hash. Another step includes searching a key-value table of a deduplication storage to determine whether the second hash matches any key in the key-value table. Another step includes, upon determining that the second hash does not match any key in the key-value table, encrypting, using an encrypt/decrypt function, the plain text block using the first hash as an encryption password and inserting a key-value pair into the key-value table with the key being the second hash and the value being the encrypted block.

CROSS-REFERENCE TO A RELATED APPLICATION

This application is a continuation of U.S. patent application Ser. No.14/508,654, filed Oct. 7, 2014, and titled “CLIENT-SIDE ENCRYPTION IN ADEDUPLICATION BACKUP SYSTEM,” which is incorporated herein by referencein its entirety.

FIELD

The embodiments disclosed herein relate to client-side encryption in adeduplication backup system.

BACKGROUND

A storage is computer-readable media capable of storing data in blocks.Storages face a myriad of threats to the data they store and to theirsmooth and continuous operation. In order to mitigate these threats, abackup of the data in a storage may be created at a particular point intime to enable the restoration of the data at some future time. Such arestoration may become desirable, for example, if the storageexperiences corruption of its stored data, if the storage becomesunavailable, or if a user wishes to create a second identical storage.

A storage is typically logically divided into a finite number offixed-length blocks. A storage also typically includes a file systemwhich tracks the locations of the blocks that are allocated to each filethat is stored in the storage. The file system also tracks the blocksthat are not allocated to any file. The file system generally tracksallocated and free blocks using specialized data structures, referred toas file system metadata. File system metadata is also stored indesignated blocks in the storage.

Various techniques exist for backing up a source storage. One commontechnique involves backing up individual files stored in the sourcestorage on a per-file basis. This technique is often referred to as filebackup. File backup uses the file system of the source storage as astarting point and performs a backup by writing the files to adestination storage. Using this approach, individual files are backed upif they have been modified since the previous backup. File backup may beuseful for finding and restoring a few lost or corrupted files. However,file backup may also include significant overhead in the form ofbandwidth and logical overhead because file backup requires the trackingand storing of information about where each file exists within the filesystem of the source storage and the destination storage.

Another common technique for backing up a source storage ignores thelocations of individual files stored in the source storage and insteadsimply backs up all allocated blocks stored in the source storage. Thistechnique is often referred to as image backup because the backupgenerally contains or represents an image, or copy, of the entireallocated contents of the source storage. Using this approach,individual allocated blocks are backed up if they have been modifiedsince the previous backup. Because image backup backs up all allocatedblocks of the source storage, image backup backs up both the blocks thatmake up the files stored in the source storage as well as the blocksthat make up the file system metadata. Also, because image backup backsup all allocated blocks rather than individual files, this approach doesnot necessarily need to be aware of the file system metadata or thefiles stored in the source storage, beyond utilizing minimal knowledgeof the file system metadata in order to only back up allocated blocks,since free blocks are not generally backed up.

Image backup can be relatively fast compared to file backup becausereliance on the file system is minimized. An image backup can also berelatively fast compared to a file backup because seeking during imagebackup may be reduced. In particular, during image backup, blocks aregenerally read sequentially with relatively limited seeking. Incontrast, during file backup, blocks that make up individual files maybe scattered in the source storage, resulting in relatively extensiveseeking.

One common problem encountered when backing up multiple similar sourcestorages to the same backup storage using image backup is the potentialfor redundancy within the backed-up data. For example, if multiplesource storages utilize the same commercial operating system, such asWINDOWS® 8 Professional, they may store a common set of system fileswhich will have identical blocks. If these source storages are backed upto the same backup storage, these identical blocks will be stored in thebackup storage multiple times, resulting in redundant blocks. Redundancyin a backup storage may increase the overall size requirements of backupstorage and increase the bandwidth overhead of transporting blocks tothe backup storage.

While this redundancy problem can be mitigated to a certain extentthrough the use of a deduplication vault, a standard deduplicationvault, in order to deduplicate the blocks of a storage, must firstreceive the blocks from the computer system of the storage inunencrypted form, after which the deduplication vault will store theblock if it is unique, or if the vault supports encryption it willencrypt and store the encrypted block if it is unique. In this way thestandard deduplication vault will support deduplication of blocks frommultiple systems. However, as the standard deduplication vault requires,at least temporarily, access to the unencrypted blocks, this provides anopportunity for these blocks to be compromised should the security ofthe deduplication vault be compromised or faulty. For this reason,encrypted deduplication vaults have been developed in which each blockis encrypted by the source computer system prior to backing up the blockinto the encrypted deduplication vault, such that the deduplicationvault, without being provided the decryption key, is unable to decryptthe encrypted blocks.

While encrypted deduplication vaults have alleviated the concernsregarding unauthorized access to sensitive blocks, a common problemencountered during backup into an encrypted deduplication vault is thatencrypted blocks may not be capable of deduplication across differentclients. In particular, while the blocks that make up a commercialoperating system or a standard application may be identical in theirplain text form, encryption of two identical plain text blocks canresult in differences in the encrypted versions of the blocks, as eachclient is likely to use its own unique encryption password. Thus, evenif an identical plain text block is backed up across different sourcestorages, the encrypted block that is actually stored in thededuplication vault may be different for each source storage, resultingin the identical plain text block being stored multiple times indifferent encrypted forms. As a result, the benefits of deduplicationmay be lost even when identical blocks are being backed up becausedifferent source systems may encrypt identical blocks differently,particularly if different encryption passwords are used on the differentsource systems.

The subject matter claimed herein is not limited to embodiments thatsolve any disadvantages or that operate only in environments such asthose described above. Rather, this background is only provided toillustrate one example technology area where some embodiments describedherein may be practiced.

SUMMARY

In general, example embodiments described herein relate to client-sideencryption in a deduplication backup system. The example methodsdisclosed herein may be employed to encrypt plain-text blocks at asource system (i.e., a client) prior to sending the blocks to adeduplication vault system. This client-side encryption reduces thepotential for an unauthorized user to access the original plain-textblocks even where the unauthorized user has access to the deduplicationvault system. Further, the example methods disclosed herein may also beemployed to encrypt plain-text blocks in such a way that only a singleencrypted block is stored in the deduplication vault storage for eachunique plain-text block that is backed-up across multiple sourcestorages of multiple clients. Thus, the example methods disclosed hereinemploy client-side encryption with deduplication which enables sensitiveblocks to remain secure within the deduplication vault storage evenwhile redundancy within and across multiple source storages is reducedor eliminated. This may increase the number of blocks from a sourcestorage that are already duplicated in the deduplication vault storageat the time that a backup of the source storage is created in thededuplication vault storage, thereby decreasing the number of blocksthat must be copied from the source storage to the deduplication vaultstorage. Decreasing the number of blocks that must be copied from thesource storage to the deduplication vault storage during the creation ofa backup may result in decreased bandwidth overhead of transportingblocks to the deduplication vault storage and increased efficiency andspeed during the creation of each backup.

In one example embodiment, a method for client-side encryption in adeduplication backup system includes a backup phase in which varioussteps are performed for each allocated plain text block stored in asource storage at a point in time. One step includes hashing, using afirst cryptographic hash function, the plain text block to generate afirst hash. Another step includes hashing, using a second cryptographichash function, the first hash to generate a second hash. Another stepincludes searching a key-value table of a deduplication storage todetermine whether the second hash matches any key in the key-valuetable. In this step, each key-value pair in the key-value table includesa key that is a hash and a value that is an encrypted block. Anotherstep includes, upon determining that the second hash does not match anykey in the key-value table, encrypting, using an encrypt/decryptfunction, the plain text block using the first hash as an encryptionpassword and inserting a key-value pair into the key-value table withthe key being the second hash and the value being the encrypted block.Another step includes inserting an entry into an image map correspondingto the source storage that includes the first hash and a position of theplain text block as stored in the source storage.

In another example embodiment, a method for client-side encryption in adeduplication backup system includes a backup phase in which varioussteps are performed for each allocated plain text block stored in asource storage at a point in time. One step includes hashing, using afirst cryptographic hash function, the plain text block to generate afirst hash. Another step includes encrypting, using an encrypt/decryptfunction, the plain text block using the first hash as an encryptionpassword. Another step includes hashing, using a second cryptographichash function, the encrypted block to generate a third hash. Anotherstep includes searching a key-value table of a deduplication storage todetermine whether the third hash matches any key in the key-value table.In this step, each key-value pair in the key-value table includes a keythat is a hash and a value that is an encrypted block. Another stepincludes, upon determining that the third hash does not match any key inthe key-value table, inserting a key-value pair into the key-value tablewith the key being the third hash and the value being the encryptedblock. Another step includes inserting an entry into an image mapcorresponding to the source storage that includes the first hash, thethird hash, and a position of the plain text block as stored in thesource storage.

It is to be understood that both the foregoing general description andthe following detailed description are exemplary and explanatory and arenot restrictive of the invention as claimed.

BRIEF DESCRIPTION OF THE DRAWINGS

Example embodiments will be described and explained with additionalspecificity and detail through the use of the accompanying drawings inwhich:

FIG. 1 is a schematic block diagram illustrating an examplededuplication backup system;

FIGS. 2A-2D are schematic diagrams illustrating client-side encryptionin a deduplication backup system;

FIGS. 3A-3B is a schematic flowchart illustrating a first example methodfor client-side encryption in a deduplication backup system;

FIGS. 4A-4D are schematic diagrams illustrating client-side encryptionin a deduplication backup system; and

FIGS. 5A-5B is a schematic flowchart illustrating a second examplemethod for client-side encryption in a deduplication backup system.

DESCRIPTION OF EMBODIMENTS

The term “storage” as used herein refers to computer-readable media, orsome logical portion thereof such as a volume, capable of storing datain blocks. The term “block” as used herein refers to a fixed-lengthdiscrete sequence of bits. In some example embodiments, the size of eachblock may be configured to match the standard sector size of a filesystem of a storage on which the block is stored. For example, the sizeof each block may be 512 bytes (4096 bits) where 512 bytes is the sizeof a standard sector. The term “allocated block” as used herein refersto a block in a storage that is currently tracked as storing data by afile system of the storage. The term “free block” as used herein refersto a block in a storage that is not currently employed nor tracked asstoring data by a file system of the storage. The term “backup,” whenused herein as a noun, refers to a copy or copies of one or more blocksfrom a storage. The term “base backup” as used herein refers to a basebackup of a storage that includes at least a copy of each uniqueallocated block of the storage at a point in time such that the basebackup can be restored on its own to recreate the state of the storageat the point in time, without being dependent on any other backup. A“base backup” may also include nonunique allocated blocks and freeblocks of the storage at the point in time. The term “incrementalbackup” as used herein refers to an at least partial backup of a storagethat includes at least a copy of each unique allocated block of thestorage that was modified between a previous point in time of a previousbackup of the storage and the subsequent point in time of theincremental backup, such that the incremental backup, along with allprevious backups of the storage, including an initial base backup of thestorage, can be restored together to recreate the state of desiredblocks of the storage at the subsequent point in time. The term“modified block” as used herein refers to a block that was modifiedeither because the block was previously-allocated and changed or becausethe block was modified by being newly-allocated. An “incremental backup”may also include nonunique allocated blocks and free blocks of thestorage that were modified between the previous point in time and thesubsequent point in time. Only “unique allocated blocks” may be includedin a “base backup” or an “incremental backup” where only a single copyof multiple duplicate allocated blocks (i.e., nonunique allocatedblocks) is backed up to reduce the size of the backup. A “base backup”or an “incremental backup” may exclude certain undesired allocatedblocks such as blocks belonging to files whose contents are notnecessary for restoration purposes, such as virtual memory paginationfiles and machine hibernation state files.

FIG. 1 is a schematic block diagram illustrating an examplededuplication backup system 100. As disclosed in FIG. 1, the examplededuplication backup system 100 includes a deduplication vault system102, a source system 104 of Company A, and a source system 106 ofCompany B. Company A may be a competitor of Company B, such that usersof the source system 104 of Company A would not be authorized to accesssensitive data stored in the source system 106 of Company B, andvice-versa. The systems 102, 104, and 106 include storages 108, 110, and112, respectively.

The deduplication vault storage 108 stores a base backup A and multipleincremental backups A that have been created of the source storage 110to represent the states of the source storage 110 at various points intime. For example, the base backup A represents the state of the sourcestorage 110 at time t(0), the 1st incremental backup A represents thestate of the source storage 110 at time t(2), the 2nd incremental backupA represents the state of the source storage 110 at time t(4), and thenth incremental backup A represents the state of the source storage 110at time t(2 n). Similarly, the deduplication vault storage 108 stores abase backup B and multiple incremental backups B that have been createdof the source storage 112 to represent the state of the source storage112 at various points in time. For example, the base backup B representsthe state of the source storage 112 at time t(1), the 1st incrementalbackup B represents the state of the source storage 112 at time t(3),the 2nd incremental backup B represents the state of the source storage112 at time t(5), and the nth incremental backup B represents the stateof the source storage 112 at time t(2 n+1). The deduplication vaultsystem 102 also includes a database 114, metadata 116, and adeduplication module 118. The source systems 104 and 106 also includeencryption modules 124 and 126, respectively. The source systems 104 and106 are able to communicate with the deduplication vault system 102 overa network 120.

Each of the systems 102, 104, and 106 may be any computing devicecapable of supporting a storage and communicating with other systemsincluding, for example, file servers, web servers, personal computers,desktop computers, laptop computers, handheld devices, multiprocessorsystems, microprocessor-based or programmable consumer electronics,smartphones, digital cameras, hard disk drives, flash memory drives, andvirtual machines. The network 120 may be any wired or wirelesscommunication network including, for example, a Local Area Network(LAN), a Metropolitan Area Network (MAN), a Wide Area Network (WAN), aWireless Application Protocol (WAP) network, a Bluetooth network, anInternet Protocol (IP) network such as the internet, or some combinationthereof.

The image backups stored in the deduplication vault storage 108 may becreated by the deduplication module 118. For example, the deduplicationmodule 118 may be configured to execute computer instructions to performimage backup operations of creating a base backup and multipleincremental backups of the source storages 110 and of the source storage112. It is noted that these image backups may initially be created onthe source systems 104 and 106 and then copied to the deduplicationvault system 102.

For example, the base backup A may be created to capture the state ofthe source storage 110 at time t(0). This image backup operation mayinclude the deduplication module 118 copying all allocated blocks of thesource storage 110 as allocated at time t(0) and storing the allocatedblocks in the deduplication vault storage 108. The state of the sourcestorage 110 at time t(0) may be captured using snapshot technology inorder to capture the blocks stored in the source storage 110 at timet(0) without interrupting other processes, thus avoiding downtime of thesource storage 110. The base backup A may be very large depending on thesize of the source storage 110 and the number of allocated blocks attime t(0). As a result, the base backup A may take a relatively longtime to create and consume a relatively large amount of space in theduplication vault storage 108, depending on how many of the blocksincluded in the base backup A were already duplicated in the duplicationvault storage 108 prior to the creation of the base backup A.

Next, the 1st and 2nd incremental backups A may be created to capturethe states of the source storage 110 at times t(2) and t(4),respectively. This may include copying only modified allocated blocks ofthe source storage 110 present at time t(2) and storing the modifiedallocated blocks in the deduplication vault storage 108, then latercopying only modified allocated blocks of the source storage 110 presentat time t(4) and storing the modified allocated blocks in thededuplication vault storage 108. The states of the source storage 110 attimes t(2) and t(4) may also be captured using snapshot technology, thusavoiding downtime of the source storage 110. Each incremental backup Amay include only those allocated blocks from the source storage 110 thatwere modified after the time of the previous backup. Thus, the 1stincremental backup may include only those allocated blocks from thesource storage 110 that were modified between time t(0) and time t(2),and the 2nd incremental backup may include only those allocated blocksfrom the source storage 110 that were modified between time t(2) andtime t(4). In general, as compared to the base backup A, eachincremental backup A may take a relatively short time to create andconsume a relatively small storage space in the deduplication vaultstorage 108, depending on how many of the blocks included in the basebackup A and the 1st and 2nd incremental backups A were alreadyduplicated in the duplication vault storage 108 prior to the creation ofthe base backup A.

Finally, an nth incremental backup A may be created to capture the stateof the source storage 110 at time t(2 n). This may include copying onlymodified allocated blocks of the source storage 110 present at time t(2n), using snapshot technology, and storing the modified allocated blocksin the deduplication vault storage 108. The nth incremental backup A mayinclude only those allocated blocks from the source storage 110 thatwere modified between time t(2 n) and the point in time of the backup ofthe source storage 110 that occurred just prior to the nth incrementalbackup A at time t(2 n).

The base backup B and the 1st, 2nd, and nth incremental backups B may becreated in a similar manner as the creation of the base backup A and the1st, 2nd, and nth incremental backups A, only instead of being createdto represent the states at times t(0), t(2), t(4), and t(2 n), the basebackup B and the 1st, 2nd, and nth incremental backups B are created torepresent the states at times t(1), t(3), t(5), and t(2 n+1). Asdisclosed herein, a time with a label t(x) is at least as late in timeas a time with a label t(x−1).

Therefore, incremental backups may be created on an ongoing basis. Thefrequency of creating new incremental backups may be altered as desiredin order to adjust the amount of data that will be lost should thesource storage 110 or 112 experience corruption of its stored blocks orbecome unavailable at any given point in time. The blocks from thesource storage 110 or 112 can be restored to the state at the point intime of a particular incremental backup by applying the image backups toa restore storage from oldest to newest, namely, first applying the basebackup and then applying each successive incremental backup up to theparticular incremental backup. Alternatively, the blocks from the sourcestorage 110 or 112 can be restored to the state at the point in time ofa particular incremental backup by applying the image backups to arestore storage concurrently, namely, concurrently applying the basebackup and each successive incremental backup up to the particularincremental backup. The restore storage may be the source storage 110 or112 or some other storage.

Although only allocated blocks are included in the example base andincremental backups discussed above, it is understood that inalternative implementations both allocated and free blocks may be backedup during the creation of a base backup or an incremental backup. Thisis typically done for forensic purposes, because the contents of freeblocks can be interesting where the free blocks contain data from aprevious point in time when the blocks were in use and allocated.Therefore, the creation of base backups and incremental backups asdisclosed herein is not limited to allocated blocks but may also includefree blocks.

Further, although only base backups and incremental backups arediscussed above, it is understood that the source storage 110 or 112 mayinstead be backed up by creating a base backup and one or moredecremental image backups. Decremental backups are created by initiallycreating a base backup to capture the state at an initial point in time,then updating the base backup to capture the state at a subsequent pointin time by modifying only those blocks in the base backup that changedbetween the initial and subsequent points in time, and by adding to thebase backup copies of any blocks newly allocated between the initial andsubsequent point in time. Prior to the updating of the base backup,however, the original blocks in the base backup that correspond to thechanged blocks are copied to a decremental backup, thus enablingrestoration of the source storage 110 or 112 at the initial point intime (by restoring the updated base backup and then restoring thedecremental backup or by concurrently restoring the updated base backupand the decremental backup) or at the subsequent point in time (bysimply restoring the updated base backup). Since restoring a single basebackup is generally faster than restoring a base backup and one or moreincremental or decremental backups, creating decremental backups insteadof incremental backups may enable the most recent backup to be restoredmore quickly since the most recent backup is always a base backup or anupdated base backup instead of potentially being an incremental backup.Therefore, the methods disclosed herein are not limited to encryptingbase and incremental backups, but may also include encrypting base anddecremental backups.

The database 114 and the metadata 116 may be employed to trackinformation related to the source storages 110 and 112, thededuplication vault storage 108, and the backups of the source storages110 and 112 that are stored in the deduplication vault storage 108. Forexample, the database 114 and the metadata 116 may be identical orsimilar in structure and function to the database 500 and the metadata700 disclosed in related U.S. patent application Ser. No. 13/782,549,titled “MULTIPHASE DEDUPLICATION,” which was filed on Mar. 1, 2013 andis expressly incorporated herein by reference in its entirety.Subsequently, the deduplication module 118 and/or another module mayrestore each block that was stored in the source storage 110 or 112 at aparticular point in time to a restore storage.

In one example embodiment, the deduplication vault system 102 may be afile server, the source system 104 may be a first desktop computer, thesource system 106 may be a second desktop computer, and the network 120may include the internet. In this example embodiment, the file servermay be configured to periodically back up the storages of the first andsecond desktop computers over the internet as part of backup jobs bycreating base backups and multiple incremental backups and storing themin the storage of the file server. The first and second desktopcomputers may also be configured to track modifications to theirstorages between backups in order to easily and quickly identify onlythose blocks that were modified for use in the creation of anincremental backup. The file server may also be configured to restoreone or more of the backups to a storage of a restore computer over theinternet if the first or second desktop computer experiences corruptionof its storage or if the first or second desktop computer's storagebecomes unavailable.

Although only a single storage is disclosed in each of the systems 102,104, and 106 in FIG. 1, it is understood that any of the systems 102,104, and 106 may instead include two or more storages. Further, althoughthe systems 102, 104, and 106 are disclosed in FIG. 1 as communicatingover the network 120, it is understood that the systems 102 and 104 or102 and 106 may instead communicate directly with each other. Further,the storage 110 or 112 may function as both a source storage and arestore storage. For example, in some embodiments the storage 110 or 112may function as a source storage during the creation of a backup and asa restore storage during a restoration of the backup, which may enablethe storage 110 or 112 to be restored to a state of an earlier point intime.

Further, although the deduplication module 118, the encryption module124, and the encryption module 126 are the only modules disclosed in theexample deduplication backup system 100 of FIG. 1, it is understood thatthe functionality of the modules 118, 124, and 126 may be replaced oraugmented by one or more similar modules residing on any of the systems102, 104, and 106 or another system. Finally, although only two sourcestorages 110 and 112 are disclosed in the example deduplication backupsystem 100 of FIG. 1, it is understood that the deduplication vaultsystem 102 of FIG. 1 may be configured to simultaneously back up manymore source storages and/or to simultaneously restore many more restorestorages. For example, the greater the number of source storages thatare backed up to the deduplication vault storage 108, the greater thelikelihood for reducing redundancy and for reducing the overall numberof blocks being backed up, resulting in corresponding decreases in thebandwidth overhead of transporting blocks to the deduplication vaultstorage 108.

Having described one specific environment with respect to FIG. 1, it isunderstood that the specific environment of FIG. 1 is only one ofcountless environments in which the example methods disclosed herein maybe practiced. The scope of the example embodiments is not intended to belimited to any particular environment.

FIGS. 2A-2D are schematic diagrams illustrating client-side encryption200 in the deduplication backup system 100. Prior to the client-sideencryption 200, the deduplication vault storage 108 may have been seededwith common blocks and/or various image backup operations of one or morebackup jobs may have transpired, which will have resulted in theinsertions of various blocks into the deduplication vault storage 108,such as the blocks at positions 108(4)-108(8). Further, prior to theclient-side encryption 200, allocated blocks in the source storages 110and 112 are identified as being appropriate for being backed up. In thecase of a base backup, all allocated blocks may be identified, and inthe case of an incremental, only allocated blocks that have potentiallybeen modified may be identified. The client-side encryption 200illustrates the creation of the base backup A of the source storage 110to represent the state of the source storage 110 at time t(0) in FIGS.2A-2B, and illustrates the creation of the base backup B of the sourcestorage 112 to represent the state of the source storage 112 at timet(1) in FIGS. 2C-2D. Although the source storages 110 and 112 are eachdepicted with only eight blocks and the deduplication vault storage 108is depicted with only sixteen blocks, it is understood that the storages108, 110, and 112 may include many more blocks, such as millions orbillions or potentially even more blocks. Plain text blocks in thedrawings are illustrated with a hatch pattern than angles down to theleft, while encrypted blocks are illustrated in the drawings with ahatch pattern than angles down to the right. Hash values, also referredto herein as hashes, are illustrated as “HX,” where X is a number thatrepresents a unique hash.

As disclosed in FIG. 2A, a snapshot is taken of the source storage 110at time t(0) and allocated plain text blocks at positions 110(1),110(2), 110(4), 110(6), and 110(7) are targeted to be included in thebase backup A of the source storage 110. Each of these blocks is thenread from the source storage 110, hashed, using a 1st cryptographic hashfunction, to generate a 1st hash, and then the 1st hash is hashed, usinga 2nd cryptographic hash function, to generate a 2nd hash. Next, it isdetermined whether the 2nd hash matches any key in the key-value tableof the deduplication vault storage 108, where each key-value pair in thekey-value table includes a key that is a hash and a value that is anencrypted block. As disclosed in FIG. 2A, only the 2nd hash H38 matchesthe key at position 108(4) in the key-value table, while the 2nd hashesH27, H23, and H29 do not match any key in the key value table. Next, anentry is inserted into an image map 202 corresponding to the base backupA of the source storage 110 that includes the corresponding 1st hash H18and the position 110(2) of the plain text block as stored in the sourcestorage 110. Where multiple items of data are included in the same entryin an image map, it is understood that the items are associated with oneanother and that this association is stored in the entry. Therefore, theinclusion of the 1st hash H18 and the position 110(2) into the sameentry in the image map 202 in this example associates the 1st hash H18with the position 110(2). The image maps disclosed in the drawings maybe implemented in the metadata 116 of the duplication vault system 102of FIG. 1. Further, the image maps disclosed in the drawings may bestored in plain text or may themselves be encrypted. Also, the imagemaps disclosed in the drawings may each be stored locally in the sourcestorage of the corresponding source system or may each be storedremotely in the deduplication vault storage 108 of the deduplicationvault system 102. When the image map is encrypted, it may be encryptedafter the backup phases disclosed herein, and then decrypted prior tothe restore phases disclosed herein.

As disclosed in FIG. 2B, since the 2nd hashes H27, H23, and H29 do notmatch any key in the key value table, each of their corresponding plaintext blocks is encrypted, using an encrypt/decrypt function, using the1st hash as an encryption password, and then a key-value pair isinserted into the key-value table with the key being the 2nd hash andthe value being the encrypted block, and then an entry is inserted intothe image map 202 corresponding to the source storage 110 that includesthe 1st hash and a position of the plain text block as stored in thesource storage 110. It is noted that since the block at position 110(4)and the block at position 110(7) are duplicates, only the first instanceof this duplicate block is encrypted and inserted into the key-valuetable, but entries for both of the duplicate blocks are inserted intothe image map 202. It is further noted that an “encrypt/decryptfunction” may actually be two separate functions, one for encrypting andanother for decrypting, in which case the “encrypt/decrypt function” isthe combination of an encrypt function and a decrypt function. It isalso noted that each block may be processed individually through each ofthe steps disclosed in FIGS. 2A and 2B, and below in FIGS. 2C and 2D,instead of a step being performed concurrently on all relevant blocks.

As disclosed in FIG. 2C, a snapshot is then taken of the source storage112 at time t(1) and allocated plain text blocks at positions 112(1),112(2), 112(3), and 112(5) are targeted to be included in the basebackup B of the source storage 112. Each of these blocks is then readfrom the source storage 112, hashed, using the 1st cryptographic hashfunction, to generate a 1st hash, and then the 1st hash is hashed, usingthe 2nd cryptographic hash function, to generate a 2nd hash. Next, it isdetermined whether the 2nd hash matches any key in the key-value tableof the deduplication vault storage 108. As disclosed in FIG. 2C, onlythe 2nd hashes H23 and H38 match the keys at positions 108(2) and108(4), respectively, in the key-value table, while the 2nd hashes H67and H71 do not match any key in the key value table. Next, entries areinserted into an image map 204 corresponding to the base backup B of thesource storage 112 that each includes the corresponding 1st hash and theposition of the plain text block as stored in the source storage 112.

As disclosed in FIG. 2D, since the 2nd hashes H67 and H71 do not matchany key in the key value table, each of their corresponding plain textblocks is encrypted, using the encrypt/decrypt function, using the 1sthash as an encryption password, then a key-value pair are inserted intothe key-value table with the key being the 2nd hash and the value beingthe encrypted block, and an entry is inserted into the image map 204corresponding to the source storage that includes the 1st hash and aposition of the plain text block as stored in the source storage 110.

Therefore, during the client-side encryption 200 of FIGS. 2A-2D,plain-text blocks of the source storages 110 and 112 may be encrypted atthe source system 104 of Company A and at the source system 106 ofCompany B prior to sending the blocks to the deduplication vault storage108. This client-side encryption 200 reduces the potential for anunauthorized user to access the original plain-text blocks. Further, theclient-side encryption 200 encrypts plain-text blocks in such a way thatonly a single encrypted block is stored in the deduplication vaultstorage 108 for each unique plain-text block that is backed up acrossthe source storages 110 and 112. For example, only a single encryptedblock is stored at position 108(4) of the key value table for theduplicate blocks at positions 110(2) and 112(5), and only a singleencrypted block is stored at position 108(2) of the key value table forthe duplicate blocks at positions 110(4), 110(7), and 112(2). Thus, theclient-side encryption 200 employs client-side encryption withdeduplication which enables sensitive blocks to remain secure within thekey value table of the deduplication vault storage 108 even whileredundancy within and across the source storages 110 and 112 is reducedor eliminated. As disclosed in FIGS. 2A-2D, since the blocks atpositions 110(2), 110(7), 112(2), and 112(5) are already duplicated inthe deduplication vault storage 108 at the time that the base backups Aand B of the source storages 110 and 112 are created in thededuplication vault storage 108, these blocks do not need to be copiedfrom the source storages 110 and 112 to the deduplication vault storage108, resulting in decreased bandwidth overhead of transporting blocks tothe deduplication vault storage 108 and increased efficiency and speedduring the creation of the base backups A and B.

FIGS. 3A-3B is a schematic flowchart illustrating a first example method300 for client-side encryption in the deduplication backup system 100.The method 300 may be implemented, in at least some embodiments, by thededuplication module 118 of the deduplication vault system 102, by theencryption module 124 of the source system 104, and by the encryptionmodule 126 of the source system 106 of FIG. 1. For example, thesemodules may be configured to execute computer instructions to performoperations of client-side encryption of the source storages 110 and 112prior to being backed up into the deduplication vault storage 108, asrepresented by one or more of phases 302-308 which are made up of thesteps 310-364 of the method 300. Although illustrated as discrete phasesand steps, various phases/steps may be divided into additionalphases/steps, combined into fewer phases/steps, reordered, oreliminated, depending on the desired implementation. The method 300 willnow be discussed with reference to FIGS. 1, 2A-2D, and 3A-3B.

The method 300 may include a backup phase 302 for Company A, a restorephase 304 for Company A, a backup phase 306 for Company B, and a restorephase 308 for Company B.

The backup phase 302 of the method 300 may include a step 310 in whichan allocated plain text block is read from the source storage. Forexample, the encryption module 124 may read, at step 310, the plain textblock at position 110(1) or 110(2) from the source storage 110, asdisclosed in FIG. 2A.

The backup phase 302 of the method 300 may include a step 312 in whichthe plain text blocks is hashed, using a 1st cryptographic hashfunction, to generate a 1st hash. Continuing with the above example, theencryption module 124 may hash, at step 312, the plain text block fromposition 110(1) or 110(2) using the 1st cryptographic hash function togenerate a 1st hash, such as the 1st hash H7 or the 1st hash H18, asdisclosed in FIG. 2A. The 1^(st) cryptographic hash function may be aSHA-1, SHA-2, SHA-3, MD5, or other cryptographic hash function, forexample.

The backup phase 302 of the method 300 may include a step 314 in whichthe 1^(st) hash is hashed, using a 2nd cryptographic hash function, togenerate a 2nd hash. Continuing with the above example, the encryptionmodule 124 may hash, at step 314, the 1st hash H7 or the 1st hash H18using the 2nd cryptographic hash function to generate the 2nd hash H27or the 2nd hash H38, as disclosed in FIG. 2A. The 2nd cryptographic hashfunction may be a SHA-1, SHA-2, SHA-3, MD5, or other cryptographic hashfunction, for example, and may be the same as, or different from, the1st cryptographic hash function.

The backup phase 302 of the method 300 may include a step 316 in which akey-value table of a deduplication vault is searched to determinewhether the 2nd hash matches any key in the key-value table, where eachkey-value pair in the key-value table includes a key that is a hash anda value that is an encrypted block. Continuing with the above example,the deduplication module 118 may search, at step 316, the key-valuetable of the deduplication vault storage 108 to determine that the 2ndhash H27 does not match any key in the key-value table, or to determinethat the 2nd hash H38 does match a key at position 108(4) in thekey-value table, as disclosed in FIG. 2B. Upon determining that thesecond hash does not match any key in the key-value table (No at step316), the backup phase 302 of the method 300 may include steps 318 and320. Otherwise (Yes at step 316), the backup phase 302 of the method 300may proceed directly to the step 322.

The backup phase 302 of the method 300 may include a step 318 in whichthe plain text block is encrypted, using an encrypt/decrypt function,using the 1st hash as an encryption password. Continuing with the aboveexample, the encryption module 124 may encrypt, at step 318, the plaintext block from position 110(1) using an encrypt/decrypt function, usingthe 1st hash H7 as an encryption password, resulting in an encryptedversion of the plain text block from position 110(1), as disclosed inFIG. 2B.

The backup phase 302 of the method 300 may include a step 320 in which akey-value pair is inserted into the key-value table with the key beingthe 2nd hash and the value being the encrypted block. Continuing withthe above example, the deduplication module 118 may insert, at step 320,a key-value pair into the key-value table at position 108(1) with thekey being the 2nd hash H27 and the value being the encrypted version ofthe plain text block at position 110(1), as disclosed in FIG. 2B.

The backup phase 302 of the method 300 may include a step 322 in whichan entry is inserted into an image map corresponding to the sourcestorage that includes the 1st hash and a position of the plain textblock as stored in the source storage. Continuing with the aboveexample, the deduplication module 118 may insert, at step 322, an entryinto the image map 202 corresponding to the source storage 110 thatincludes the 1st hash H18 and position 110(2), as disclosed in FIG. 2A,or that includes the 1st hash H7 and position 110(1), as disclosed inFIG. 2B.

The backup phase 302 of the method 300 may include a step 324 in whichit is determined whether all appropriate blocks to be included in thebackup have been read from the source storage. In the case of a basebackup, all unique allocated blocks may be identified, and in the caseof an incremental, only unique allocated blocks that have potentiallybeen modified may be identified. Continuing with the above example, thededuplication module 118 may determine, at step 324, whether all of theallocated blocks at positions 110(1), 110(2), 110(4), 110(6), and 110(7)have been read from the source storage 110, as disclosed in FIG. 2B. Ifit is determined at step 324 that all allocated blocks have not beenread from the source storage 110 (No at step 324), then the method 300returns to step 310 where the next allocated block is read from thesource storage 110. Otherwise (Yes at step 324), the backup phase 302 ofthe method 300 is complete, and the method 300 proceeds to step 326 ofthe restore phase 304.

By the conclusion of the backup phase 302, a backup of the sourcestorage 110 will have been stored in the deduplication vault storage108. Unlike a standard backup image, however, the backup of the sourcestorage 110 as stored in the deduplication vault storage 108 has beenreduced in size due to not storing multiple copies of the blocks frompositions 110(2) and 110(7), as disclosed in FIG. 2B. In addition, wheremultiple storages are backed up into the deduplication vault storage108, the total overall size of the backups will likely be reduced insize due to the elimination of duplicate blocks across the backups.Finally, unlike standard deduplication vault storages, the deduplicationvault storage 108 is configured to store each of the plain text blocksof the source storage 110 included in the backup as encrypted blocks,thus reducing the potential for an unauthorized user, such as a userfrom Company B, to access the original plain-text blocks, except forthose blocks that are included in a backup of the unauthorized user.

The restore phase 304 of the method 300 may include a step 326 in whichan entry is read in the image map. For example, the deduplication module118 may read, at step 326, the first entry in the image map 202, whichincludes the 1st hash H18 and source position 110(2), as disclosed inFIG. 2B.

The restore phase 304 of the method 300 may include a step 328 in whichthe 1st hash included in the entry is hashed, using the 2ndcryptographic hash function, to generate the 2nd hash. Continuing withthe above example, the encryption module 124 may hash, at step 328, the1st hash H18, using the 2nd cryptographic hash function, to generate the2nd hash H38, as disclosed in FIG. 2B.

The restore phase 304 of the method 300 may include a step 330 in whichthe key-value table is searched to retrieve the encrypted block of thekey-value pair having a key that matches the 2nd hash. Continuing withthe above example, the deduplication module 118 may search, at step 330,the key-value table of the deduplication vault storage 108 to retrievethe encrypted block of the key-value pair at position 108(4) that has akey that matches the 2nd hash H38, as disclosed in FIG. 2B.

The restore phase 304 of the method 300 may include a step 332 in whichthe encrypted block is decrypted, using the encrypt/decrypt function,and using the 1st hash as a decryption password. Continuing with theabove example, the encryption module 124 may decrypt, at step 332, theencrypted block, using the encrypt/decrypt function, and using the 1sthash H18 as a decryption password, resulting in the plain text blockfrom position 110(2) of the source storage 110, as disclosed in FIG. 2B.

The restore phase 304 of the method 300 may include a step 334 in whichthe decrypted block is stored in a restore storage at the positionincluded in the entry. Continuing with the above example, the encryptionmodule 124 may store, at step 334, the decrypted block in the sourcestorage 110, where the source storage 110 is functioning as a restorestorage, in the position 110(2), as disclosed in FIG. 2B.

The restore phase 304 of the method 300 may include a step 336 in whichit is determined whether all entries have been read from the image map.Continuing with the above example, the deduplication module 118 maydetermine, at step 336, whether all of the entries have been read fromthe image map 202, as disclosed in FIG. 2B. If it is determined at step336 that all entries have not been read from the image map 202 (No atstep 336), then the method 300 returns to step 326 where the next entryis read from the image map 202. Otherwise (Yes at step 336), the restorephase 304 of the method 300 is complete, and the method 300 proceeds tostep 338 of the backup phase 306.

By the conclusion of the restore phase 304, a backup of the sourcestorage 110 that was stored in the deduplication vault storage 108 willhave been restored to a restore storage. Unlike a standard restoration,however, the restoration of the backup of the source storage 110involves the backup remaining securely encrypted until being decryptedat the source system 104, thus reducing the potential for anunauthorized user, such as a user from Company B, to access the originalplain-text blocks, except for those blocks that are included in a backupof the unauthorized user.

The backup phase 306 and the restore phase 308 of the method 300 aresimilar in many respects to the backup phase 302 and the restore phase304 of the method 300, the main difference being that the backup phase306 and the restore phase 308 are performed on the source system 106 ofCompany B instead of on the source system 104 of Company A.

The backup phase 306 of the method 300 may include a step 338 in whichan allocated plain text block is read from the source storage. Forexample, the encryption module 126 may read, at step 338, the plain textblock at position 112(1) or 112(2) from the source storage 112, asdisclosed in FIG. 2C.

The backup phase 306 of the method 300 may include a step 340 in whichthe plain text block is hashed, using the same 1st cryptographic hashfunction used in the step 312, to generate a 4th hash. Continuing withthe above example, the encryption module 126 may hash, at step 340, theplain text block from position 112(1) or 112(2) using the 1stcryptographic hash function to generate a 4th hash, such as the 4th hashH47 or the 4th hash H3, as disclosed in FIG. 2C.

The backup phase 306 of the method 300 may include a step 342 in whichthe 4th hash is hashed, using the same 2nd cryptographic hash functionused in step 314, to generate a 5th hash. Continuing with the aboveexample, the encryption module 126 may hash, at step 342, the 4th hashH47 or the 4th hash H3 using the 2nd cryptographic hash function togenerate the 5th hash H67 or the 5th hash H23, as disclosed in FIG. 2C.

The backup phase 306 of the method 300 may include a step 344 in which akey-value table of a deduplication vault is searched to determinewhether the 5th hash matches any key in the key-value table. Continuingwith the above example, the deduplication module 118 may search, at step344, the key-value table of the deduplication vault storage 108 todetermine that the 5th hash H67 does not match any key in the key-valuetable, or to determine that the 5th hash H23 does match a key atposition 108(2) in the key-value table, as disclosed in FIG. 2C. Upondetermining that the second hash does not match any key in the key-valuetable (No at step 344), the backup phase 306 of the method 300 mayinclude steps 346 and 348. Otherwise (Yes at step 344), the backup phase306 of the method 300 may proceed directly to the step 350.

The backup phase 306 of the method 300 may include a step 346 in whichthe plain text block is encrypted, using an encrypt/decrypt function,using the 4th hash as an encryption password. Continuing with the aboveexample, the encryption module 126 may encrypt, at step 346, the plaintext block from position 112(1) using an encrypt/decrypt function, usingthe 4th hash H47 as an encryption password, resulting in an encryptedversion of the plain text block from position 112(1), as disclosed inFIG. 2D.

The backup phase 306 of the method 300 may include a step 348 in which akey-value pair is inserted into the key-value table with the key beingthe 5th hash and the value being the encrypted block. Continuing withthe above example, the deduplication module 118 may insert, at step 348,a key-value pair into the key-value table at position 108(9) with thekey being the 5th hash H67 and the value being the encrypted version ofthe plain text block from position 112(1), as disclosed in FIG. 2D.

The backup phase 306 of the method 300 may include a step 350 in whichan entry is inserted into an image map corresponding to the sourcestorage that includes the 4th hash and a position of the plain textblock as stored in the source storage. Continuing with the aboveexample, the deduplication module 118 may insert, at step 350, an entryinto the image map 204 corresponding to the source storage 112 thatincludes the 4th hash H3 and position 112(2), as disclosed in FIG. 2C,or that includes the 4th hash H47 and position 112(1), as disclosed inFIG. 2D.

The backup phase 306 of the method 300 may include a step 352 in whichit is determined whether all appropriate blocks to be included in thebackup have been read from the source storage. Continuing with the aboveexample, the deduplication module 118 may determine, at step 352,whether all of the allocated blocks at positions 112(1), 112(2), 112(3),and 112(5) have been read from the source storage 112, as disclosed inFIG. 2D. If it is determined at step 352 that all allocated blocks havenot been read from the source storage 112 (No at step 352), then themethod 300 returns to step 338 where the next allocated block is readfrom the source storage 112. Otherwise (Yes at step 352), the backupphase 306 of the method 300 is complete, and the method 300 proceeds tostep 354 of the restore phase 308.

By the conclusion of the backup phase 306, a backup of the sourcestorage 112 will have been stored in the deduplication vault storage108, along with the backup of the source storage 110. Unlike a standardbackup image, however, the backup of the source storage 112 as stored inthe deduplication vault storage 108 has been reduced in size due to notstoring multiple copies of the duplicate blocks from positions 112(2)and 112(5), as disclosed in FIG. 2D. Further, the method 300 is employedto encrypt the duplicate plain-text block from position 110(4) andposition 112(2) in such a way that only a single encrypted block isstored in position 108(2) in the deduplication vault storage 108 forthis duplicate block. Similarly, the method 300 is employed to encryptthe duplicate plain-text block from position 110(2) and position 112(5)in such a way that only a single encrypted block is stored in position108(4) in the deduplication vault storage 108 for this duplicate block.Therefore, unlike standard deduplication vaults, which either store asingle plain-text deduplicated block or store a single plain-text blockin two different encrypted forms, the method 300 disclosed hereinemploys client-side encryption with deduplication which enablessensitive blocks to remain secure within the deduplication vault storage108 even while redundancy within and across the source storages 110 and112 is reduced or eliminated.

The restore phase 308 of the method 300 may include a step 354 in whichan entry is read in the image map. For example, the deduplication module118 may read, at step 354, the first entry in the image map 204 whichincludes the 4th hash H3 and source position 112(2), as disclosed inFIG. 2D.

The restore phase 308 of the method 300 may include a step 356 in whichthe 4th hash included in the entry is hashed, using the 2ndcryptographic hash function, to generate the 5th hash. Continuing withthe above example, the encryption module 126 may hash, at step 356, the4th hash H3, using the 2nd cryptographic hash function, to generate the5th hash H23, as disclosed in FIG. 2D.

The restore phase 308 of the method 300 may include a step 358 in whichthe key-value table is searched to retrieve the encrypted block of thekey-value pair having a key that matches the 5th hash. Continuing withthe above example, the deduplication module 118 may search, at step 358,the key-value table of the deduplication vault storage 108 to retrievethe encrypted block of the key-value pair at position 108(2) that has akey that matches the 5th hash H23, as disclosed in FIG. 2D.

The restore phase 308 of the method 300 may include a step 360 in whichthe encrypted block is decrypted, using the encrypt/decrypt function,and using the 4th hash as a decryption password. Continuing with theabove example, the encryption module 126 may decrypt, at step 360, theencrypted block, using the encrypt/decrypt function, and using the 4thhash H3 as a decryption password, resulting in the plain text block fromposition 112(2) of the source storage 112, as disclosed in FIG. 2D.

The restore phase 308 of the method 300 may include a step 362 in whichthe decrypted block is stored in a restore storage at the positionincluded in the entry. Continuing with the above example, the encryptionmodule 126 may store, at step 362, the decrypted block in the sourcestorage 112, where the source storage 112 is functioning as a restorestorage, in the position 112(2), as disclosed in FIG. 2D.

The restore phase 308 of the method 300 may include a step 364 in whichit is determined whether all entries have been read from the image map.Continuing with the above example, the deduplication module 118 maydetermine, at step 364, whether all of the entries have been read fromthe image map 204, as disclosed in FIG. 2D. If it is determined at step364 that all entries have not been read from the image map 204 (No atstep 364), then the method 300 returns to step 354 where the next entryis read from the image map 204. Otherwise (Yes at step 364), the restorephase 308 of the method 300 is complete.

By the conclusion of the restore phase 308, a backup of the sourcestorage 112 that was stored in the deduplication vault storage 108 willhave been restored to a restore storage. Unlike a standard restoration,however, the restoration of the backup of the source storage 112involves the backup remaining securely encrypted until being decryptedat the source system 106, thus reducing the potential for anunauthorized user, such as a user from Company A, to access the originalplain-text blocks, except for those blocks that are included in a backupof the unauthorized user.

FIGS. 4A-4D are schematic diagrams illustrating client-side encryption400 in the deduplication backup system 100. The client-side encryption400 may be implemented, in at least some embodiments, with similarevents occurring prior to the client-side encryption 400 as occurredprior to the client-side encryption 200 discussed above.

As disclosed in FIG. 4A, a snapshot is taken of the source storage 110at time t(0) and allocated plain text blocks at positions 110(1),110(2), 110(4), 110(6), and 110(7) are targeted to be included in thebase backup A of the source storage 110. Each of these blocks is thenread from the source storage 110, hashed, using the 1st cryptographichash function, to generate a 1st hash, and then encrypted, using theencrypt/decrypt function, using the 1st hash as an encryption password.The encrypted block is then hashed, using the 2nd cryptographic hashfunction, to generate a 3rd hash. Next, it is determined whether the 3rdhash matches any key in the key-value table of the deduplication vaultstorage 108. As disclosed in FIG. 4A, only the 3rd hash H118 matches thekey at position 108(4) in the key-value table, while the 3rd hashesH107, H103, and H109 do not match any key in the key value table. Next,an entry is inserted into an image map 402 corresponding to the basebackup A of the source storage 110 that includes the corresponding 1sthash H18, the corresponding 3rd hash H118, and the position 110(2) ofthe plain text block as stored in the source storage 110.

As disclosed in FIG. 4B, since the 3rd hashes H107, H103, and H109 donot match any key in the key value table, key-value pairs are insertedinto the key value table for each with the key being the 3rd hash andthe value being the corresponding encrypted block. Then, entries areinserted into the image map 402 corresponding to the source storage 110that each includes the 1st hash, the 3rd hash, and the position of theplain text block as stored in the source storage 110. It is noted thatsince the block at position 110(4) and the block at position 110(7) areduplicates, only the first instance of this duplicate block is encryptedand inserted into the key-value table, but entries for both of theduplicate blocks are inserted into the image map 402.

As disclosed in FIG. 4C, a snapshot is then taken of the source storage112 at time t(1) and allocated plain text blocks at positions 112(1),112(2), 112(3), and 112(5) are targeted to be included in the basebackup B of the source storage 112. Each of these blocks is then readfrom the source storage 112, hashed, using the 1st cryptographic hashfunction, to generate a 1st hash, and then encrypted, using theencrypt/decrypt function, using the 1st hash as an encryption password.The encrypted block is then hashed, using the 2nd cryptographic hashfunction, to generate a 3rd hash. Next, it is determined whether the 3rdhash matches any key in the key-value table of the deduplication vaultstorage 108. As disclosed in FIG. 4C, only the 3rd hashes H103 and H118match the keys at positions 108(2) and 108(4), respectively, in thekey-value table, while the 3rd hashes H147 and H151 do not match any keyin the key value table. Next, entries are inserted into an image map 404corresponding to the base backup B of the source storage 112 that eachincludes the corresponding 1st hash, the corresponding 3rd hash, and theposition of the plain text block as stored in the source storage 112.

As disclosed in FIG. 4D, since the 3rd hashes H147 and H151 do not matchany key in the key value table, key-value pairs are inserted into thekey value table for each with the key being the 3rd hash and the valuebeing the corresponding encrypted block. Then, entries are inserted intothe image map 404 corresponding to the source storage 112 that eachincludes the 1st hash, the 3rd hash, and the position of the plain textblock as stored in the source storage 112.

Therefore, during the client-side encryption 400 of FIGS. 4A-4D,plain-text blocks of the source storages 110 and 112 may be encrypted atthe source system 104 of Company A and at the source system 106 ofCompany B prior to sending the blocks to the deduplication vault storage108, which may result in benefits similar to those discussed above inconnection with the client-side encryption 200 of FIGS. 2A-2D. Inaddition, the client-side encryption 400 may additionally include theadded benefit of preventing the key-value table of the deduplicationvault storage 108 from being “poisoned” by the malicious or inadvertentinsertion of an encrypted block as a value that does not match the hashinserted as its corresponding key. Any “poisoning” of the key-valuetable may be prevented in the client-side encryption 400 because each3rd hash inserted into the key-value table can be verified to match itscorresponding encrypted block by rehashing the encrypted block using the2nd cryptographic hash function, and comparing the results of the rehashoperation with the 3rd hash, where if the comparison is not identicalthen the insert is deemed to be a poisoning attempt and is thereforerejected.

FIGS. 5A-5B is a schematic flowchart illustrating a second examplemethod 500 for client-side encryption in the deduplication backup system100. The method 500 may be implemented, in at least some embodiments, ina similar manner as the method 300 discussed above. The method 500 willnow be discussed with reference to FIGS. 1, 4A-4D, and 5A-5B.

The method 500 may include a backup phase 502 for Company A, a restorephase 504 for Company A, a backup phase 506 for Company B, and a restorephase 508 for Company B.

The backup phase 502 of the method 500 may include a step 510 in whichan allocated plain text block is read from the source storage. Forexample, the encryption module 124 may read, at step 510, the plain textblock at position 110(1) or 110(2) from the source storage 110, asdisclosed in FIG. 4A.

The backup phase 502 of the method 500 may include a step 512 in whichthe plain text blocks is hashed, using a 1st cryptographic hashfunction, to generate a 1st hash. Continuing with the above example, theencryption module 124 may hash, at step 512, the plain text block fromposition 110(1) or 110(2) using the 1st cryptographic hash function togenerate the 1st hash H7 or the 1st hash H18, as disclosed in FIG. 4A.

The backup phase 502 of the method 500 may include a step 514 in whichthe plain text block is encrypted, using the encrypt/decrypt function,using the 1st hash as an encryption password. Continuing with the aboveexample, the encryption module 124 may encrypt, at step 514, the plaintext block from position 110(1) using the encrypt/decrypt function,using the 1st hash H7 as an encryption password, resulting in anencrypted version of the plain text block from position 110(1), asdisclosed in FIG. 4A. Similarly, the encryption module 124 may encrypt,at step 514, the plain text block from position 110(2) using theencrypt/decrypt function, using the 1st hash H18 as an encryptionpassword, resulting in an encrypted version of the plain text block fromposition 110(2), as disclosed in FIG. 4A.

The backup phase 502 of the method 500 may include a step 516 in whichthe encrypted block is hashed, using the 2nd cryptographic hashfunction, to generate a 3rd hash. Continuing with the above example, theencryption module 124 may hash, at step 516, the encrypted blockcorresponding to the plain text block at position 110(1) or position110(2) using the 2nd cryptographic hash function to generate the 3rdhash H107 or the 3rd hash H118, as disclosed in FIG. 4A.

The backup phase 502 of the method 500 may include a step 518 in which akey-value table of a deduplication vault is searched to determinewhether the 3rd hash matches any key in the key-value table. Continuingwith the above example, the deduplication module 118 may search, at step518, the key-value table of the deduplication vault storage 108 todetermine that the 3rd hash H107 does not match any key in the key-valuetable, or to determine that the 3rd hash H118 does match a key atposition 108(4) in the key-value table, as disclosed in FIG. 4A. Upondetermining that the 3rd hash does not match any key in the key-valuetable (No at step 518), the backup phase 502 of the method 500 mayinclude step 520. Otherwise (Yes at step 518), the backup phase 502 ofthe method 500 may proceed directly to step 522.

The backup phase 502 of the method 500 may include a step 520 in which akey-value pair is inserted into the key-value table with the key beingthe 3rd hash and the value being the encrypted block. Continuing withthe above example, the deduplication module 118 may insert, at step 520,a key-value pair into the key-value table at position 108(1) with thekey being the 3rd hash H107 and the value being the encrypted version ofthe plain text block at position 110(1), as disclosed in FIG. 4B.

The backup phase 502 of the method 500 may include a step 522 in whichan entry is inserted into an image map corresponding to the sourcestorage that includes the 1st hash, the 3rd hash, and a position of theplain text block as stored in the source storage. Continuing with theabove example, the deduplication module 118 may insert, at step 522, anentry into the image map 402 corresponding to the source storage 110that includes the 1st hash H18, the third hash H118, and position 110(2)of the plain text block as stored in the source storage 110, asdisclosed in FIG. 4A, or that includes the 1st hash H7, the 3rd hashH107, and position 110(1) of the plain text block as stored in thesource storage 110, as disclosed in FIG. 4B.

The backup phase 502 of the method 500 may include a step 524 in whichit is determined whether all appropriate blocks to be included in thebackup have been read from the source storage. Continuing with the aboveexample, the deduplication module 118 may determine, at step 524,whether all of the allocated blocks at positions 110(1), 110(2), 110(4),110(6), and 110(7) have been read from the source storage 110, asdisclosed in FIG. 2B. If it is determined at step 524 that all allocatedblocks have not been read from the source storage 110 (No at step 524),then the method 500 returns to step 510 where the next allocated blockis read from the source storage 110. Otherwise (Yes at step 524), thebackup phase 502 of the method 500 is complete, and the method 500proceeds to step 526 of the restore phase 504.

By the conclusion of the backup phase 502, a backup of the sourcestorage 110 will have been stored in the deduplication vault storage108. Unlike a standard backup image, however, the backup of the sourcestorage 110 as stored in the deduplication vault storage 108 has beenreduced in size due to not storing multiple copies of the duplicateblocks from positions 110(2) and 110(7), as disclosed in FIG. 4B. Inaddition, where multiple storages are backed up into the deduplicationvault storage 108, the total overall size of the backups will likely bereduced in size due to the elimination of duplicate blocks across thebackups. Finally, unlike standard deduplication vault storages, thededuplication vault storage 108 is configured to store each of the plaintext blocks of the source storage 110 included in the backup asencrypted blocks, thus reducing the potential for an unauthorized user,such as a user from Company B, to access the original plain-text blocks,except for those blocks that are included in a backup of theunauthorized user.

The restore phase 504 of the method 500 may include a step 526 in whichan entry is read in the image map. For example, the deduplication module118 may read, at step 526, the first entry in the image map 402 whichincludes the 1st hash H18, the 3rd hash H118, and source position110(2), as disclosed in FIG. 4B.

The restore phase 504 of the method 500 may include a step 528 in whichthe key-value table is searched to retrieve the encrypted block of thekey-value pair having a key that matches the 3rd hash. Continuing withthe above example, the deduplication module 118 may search, at step 528,the key-value table of the deduplication vault storage 108 to retrievethe encrypted block of the key-value pair at position 108(4) that has akey that matches the 3rd hash H118, as disclosed in FIG. 4B.

The restore phase 504 of the method 500 may include a step 530 in whichthe encrypted block is decrypted, using the encrypt/decrypt function,and using the 1st hash as a decryption password. Continuing with theabove example, the encryption module 124 may decrypt, at step 530, theencrypted block, using the encrypt/decrypt function, and using the 1sthash H18 as a decryption password, resulting in the plain text blockfrom position 110(2) of the source storage 110, as disclosed in FIG. 4B.

The restore phase 504 of the method 500 may include a step 532 in whichthe decrypted block is stored in a restore storage at the positionincluded in the entry. Continuing with the above example, the encryptionmodule 124 may store, at step 532, the decrypted block in the sourcestorage 110, where the source storage 110 is functioning as a restorestorage, in the position 110(2), as disclosed in FIG. 4B.

The restore phase 504 of the method 500 may include a step 534 in whichit is determined whether all entries have been read from the image map.Continuing with the above example, the deduplication module 118 maydetermine, at step 534, whether all of the entries have been read fromthe image map 402, as disclosed in FIG. 4B. If it is determined at step534 that all entries have not been read from the image map 402 (No atstep 534), then the method 500 returns to step 526 where the next entryis read from the image map 402. Otherwise (Yes at step 534), the restorephase 504 of the method 500 is complete, and the method 500 proceeds tostep 536 of the backup phase 506.

By the conclusion of the restore phase 504, a backup of the sourcestorage 110 that was stored in the deduplication vault storage 108 willhave been restored to a restore storage. Unlike a standard restoration,however, the restoration of the backup of the source storage 110involves the backup remaining securely encrypted until being decryptedat the source system 104, thus reducing the potential for anunauthorized user, such as a user from Company B, to access the originalplain-text blocks, except for those blocks that are included in a backupof the unauthorized user.

The backup phase 506 and the restore phase 508 of the method 500 aresimilar in many respects to the backup phase 502 and the restore phase504 of the method 500, the main difference being that the backup phase506 and the restore phase 508 are performed on the source system 106 ofCompany B instead of on the source system 104 of Company A.

The backup phase 506 of the method 500 may include a step 536 in whichan allocated plain text block is read from the source storage. Forexample, the encryption module 126 may read, at step 536, the plain textblock at position 112(1) or 112(2) from the source storage 112, asdisclosed in FIG. 4C.

The backup phase 506 of the method 500 may include a step 538 in whichthe plain text block is hashed, using the same 1st cryptographic hashfunction used in the step 512, to generate a 4th hash. Continuing withthe above example, the encryption module 126 may hash, at step 538, theplain text block from position 112(1) or 112(2) using the 1stcryptographic hash function to generate the 4th hash H47 or the 4th hashH3, as disclosed in FIG. 4C.

The backup phase 506 of the method 500 may include a step 540 in whichthe plain text block is encrypted, using the encrypt/decrypt function,using the 4th hash as an encryption password. Continuing with the aboveexample, the encryption module 126 may encrypt, at step 540, the plaintext block from position 112(1) using an encrypt/decrypt function, usingthe 4th hash H47 as an encryption password, resulting in an encryptedversion of the plain text block from position 112(1), as disclosed inFIG. 4C. Similarly, the encryption module 126 may encrypt, at step 540,the plain text block from position 112(2) using the encrypt/decryptfunction, using the 4th hash H3 as an encryption password, resulting inan encrypted version of the plain text block from position 110(2), asdisclosed in FIG. 4C.

The backup phase 502 of the method 500 may include a step 542 in whichthe encrypted block is hashed, using the same 2nd cryptographic hashfunction used in step 516, to generate a 6th hash. Continuing with theabove example, the encryption module 126 may hash, at step 542, theencrypted block corresponding to the plain text block at position 112(1)or position 112(2) using the 2nd cryptographic hash function to generatethe 6th hash H147 or the 6th hash H103, respectively, as disclosed inFIG. 4C.

The backup phase 506 of the method 500 may include a step 544 in which akey-value table of a deduplication vault is searched to determinewhether the 6th hash matches any key in the key-value table. Continuingwith the above example, the deduplication module 118 may search, at step544, the key-value table of the deduplication vault storage 108 todetermine that the 6th hash H147 does not match any key in the key-valuetable, or to determine that the 6th hash H103 does match a key atposition 108(2) in the key-value table, as disclosed in FIG. 4C. Upondetermining that the 6th hash does not match any key in the key-valuetable (No at step 544), the backup phase 506 of the method 500 mayinclude step 546. Otherwise (Yes at step 544), the backup phase 506 ofthe method 500 may proceed directly to step 548.

The backup phase 506 of the method 500 may include a step 546 in which akey-value pair is inserted into the key-value table with the key beingthe 6th hash and the value being the encrypted block. Continuing withthe above example, the deduplication module 118 may insert, at step 546,a key-value pair into the key-value table at position 108(9) with thekey being the 6th hash H147 and the value being the encrypted version ofthe plain text block 112(1), as disclosed in FIG. 4D.

The backup phase 506 of the method 500 may include a step 548 in whichan entry is inserted into an image map corresponding to the sourcestorage that includes the 4th hash, the 6th hash, and a position of theplain text block as stored in the source storage. Continuing with theabove example, the deduplication module 118 may insert, at step 548, anentry into the image map 404 corresponding to the source storage 112that includes the 4th hash H3, the 6th hash H103, and position 112(2) ofthe plain text block as stored in the source storage 112, as disclosedin FIG. 4C, or that includes the 4th hash H47, the 6th hash H147, andposition 112(1) of the plain text block as stored in the source storage112, as disclosed in FIG. 4D.

The backup phase 506 of the method 500 may include a step 550 in whichit is determined whether all appropriate blocks to be included in thebackup have been read from the source storage. Continuing with the aboveexample, the deduplication module 118 may determine, at step 550,whether all of the allocated blocks at positions 112(1), 112(2), 112(3),and 112(5) have been read from the source storage 112, as disclosed inFIG. 4D. If it is determined at step 550 that all allocated blocks havenot been read from the source storage 112 (No at step 550), then themethod 500 returns to step 536 where the next allocated block is readfrom the source storage 112. Otherwise (Yes at step 550), the backupphase 506 of the method 500 is complete, and the method 500 proceeds tostep 552 of the restore phase 508.

By the conclusion of the backup phase 506, a backup of the sourcestorage 112 will have been stored in the deduplication vault storage108, along with the backup of the source storage 110. Unlike a standardbackup image, however, the backup of the source storage 112 as stored inthe deduplication vault storage 108 has been reduced in size due to notstoring multiple copies of the duplicate blocks from positions 112(2)and 112(5), as disclosed in FIG. 4D. Further, the method 500 is employedto encrypt the duplicate plain-text block from position 110(4) andposition 112(2) in such a way that only a single encrypted block isstored in position 108(2) in the deduplication vault storage 108 forthis duplicate block. Similarly, the method 500 is employed to encryptthe duplicate plain-text block from position 110(2) and position 112(5)in such a way that only a single encrypted block is stored in position108(4) in the deduplication vault storage 108 for this duplicate block.Therefore, unlike standard deduplication vaults which store a singleplain-text deduplicated block, or store a single plain-text block in twodifferent encrypted forms, the method 500 disclosed herein employsclient-side encryption with deduplication which enables sensitive blocksto remain secure within the deduplication vault storage 108 even whileredundancy within and across the source storages 110 and 112 is reducedor eliminated.

The restore phase 508 of the method 500 may include a step 552 in whichan entry is read in the image map. For example, the deduplication module118 may read, at step 552, the first entry in the image map 404 whichincludes the 4th hash H3, the 6th hash H103, and source position 112(2),as disclosed in FIG. 4D.

The restore phase 508 of the method 500 may include a step 554 in whichthe key-value table is searched to retrieve the encrypted block of thekey-value pair having a key that matches the 6th hash. Continuing withthe above example, the deduplication module 118 may search, at step 554,the key-value table of the deduplication vault storage 108 to retrievethe encrypted block of the key-value pair at position 108(2) that has akey that matches the 6th hash H103, as disclosed in FIG. 4D.

The restore phase 508 of the method 500 may include a step 556 in whichthe encrypted block is decrypted, using the encrypt/decrypt function,and using the 4th hash as a decryption password. Continuing with theabove example, the encryption module 126 may decrypt, at step 556, theencrypted block, using the encrypt/decrypt function, and using the 4thhash H3 as a decryption password, resulting in the plain text block fromposition 112(2) of the source storage 112, as disclosed in FIG. 4D.

The restore phase 508 of the method 500 may include a step 558 in whichthe decrypted block is stored in a restore storage at the positionincluded in the entry. Continuing with the above example, the encryptionmodule 126 may store, at step 558, the decrypted block in the sourcestorage 112, where the source storage 112 is functioning as a restorestorage, in the position 112(2), as disclosed in FIG. 4D.

The restore phase 508 of the method 500 may include a step 560 in whichit is determined whether all entries have been read from the image map.Continuing with the above example, the deduplication module 118 maydetermine, at step 560, whether all of the entries have been read fromthe image map 404, as disclosed in FIG. 4D. If it is determined at step560 that all entries have not been read from the image map 404 (No atstep 560), then the method 500 returns to step 552 where the next entryis read from the image map 404. Otherwise (Yes at step 560), the restorephase 508 of the method 500 is complete.

By the conclusion of the restore phase 508, a backup of the sourcestorage 112 that was stored in the deduplication vault storage 108 willhave been restored to a restore storage. Unlike a standard restoration,however, the restoration of the backup of the source storage 112involves the backup remaining securely encrypted until being decryptedat the source system 106, thus reducing the potential for anunauthorized user, such as a user from Company A, to access the originalplain-text blocks, except for those blocks that are included in a backupof the unauthorized user.

It is understood that the foregoing discussion of the methods 300 and500 are but two possible implementations of client-side encryption in adeduplication backup system, and various modifications are possible andcontemplated. For example, these methods may be modified to remove thesteps or portions of steps that involve restoring a backup to a restorestorage. Further, although the methods 300 and 500 are discussed aboveas being performed by the deduplication module 118, the encryptionmodule 124, and the encryption module 126, it is understood that themethods 300 and 500 may alternatively be performed by the deduplicationmodule 118, the encryption module 124, and the encryption module 126exclusively or by some other module or combination of modules.

The embodiments described herein may include the use of aspecial-purpose or general-purpose computer, including various computerhardware or software modules, as discussed in greater detail below.

Embodiments described herein may be implemented using non-transitorycomputer-readable media for carrying or having computer-executableinstructions or data structures stored thereon. Such computer-readablemedia may be any available media that may be accessed by ageneral-purpose or special-purpose computer. By way of example, and notlimitation, such computer-readable media may include non-transitorycomputer-readable storage media including RAM, ROM, EEPROM, CD-ROM orother optical disk storage, magnetic disk storage or other magneticstorage devices, or any other storage medium which may be used to carryor store one or more desired programs having program code in the form ofcomputer-executable instructions or data structures and which may beaccessed and executed by a general-purpose computer, special-purposecomputer, or virtual computer such as a virtual machine. Combinations ofthe above may also be included within the scope of computer-readablemedia.

Computer-executable instructions comprise, for example, instructions anddata which, when executed by one or more processors, cause ageneral-purpose computer, special-purpose computer, or virtual computersuch as a virtual machine to perform a certain method, function, orgroup of methods or functions. Although the subject matter has beendescribed in language specific to structural features and/ormethodological steps, it is to be understood that the subject matterdefined in the appended claims is not necessarily limited to thespecific features or steps described above. Rather, the specificfeatures and steps described above are disclosed as example forms ofimplementing the claims.

As used herein, the term “module” may refer to software objects orroutines that execute on a computing system. The different modules orfilters described herein may be implemented as objects or processes thatexecute on a computing system (e.g., as separate threads). While thesystem and methods described herein are preferably implemented insoftware, implementations in hardware or a combination of software andhardware are also possible and contemplated.

All examples and conditional language recited herein are intended forpedagogical objects to aid the reader in understanding the exampleembodiments and the concepts contributed by the inventor to furtheringthe art, and are to be construed as being without limitation to suchspecifically-recited examples and conditions.

1. A method for client-side encryption in a deduplication backup system,the method comprising: a backup phase in which the following steps areperformed for each allocated plain text block stored in a source storageat a point in time: hashing, using a first cryptographic hash function,the plain text block to generate a first hash; hashing, using a secondcryptographic hash function, the first hash to generate a second hash;searching a key-value table of a deduplication storage to determinewhether the second hash matches any key in the key-value table, eachkey-value pair in the key-value table including a key that is a hash anda value that is an encrypted block; upon determining that the secondhash does not match any key in the key-value table, encrypting, using anencrypt/decrypt function, the plain text block using the first hash asan encryption password and inserting a key-value pair into the key-valuetable with the key being the second hash and the value being theencrypted block; and inserting an entry into an image map correspondingto the source storage that includes the first hash and a position of theplain text block as stored in the source storage.
 2. The method asrecited in claim 1, further comprising: encrypting the image map; andstoring the encrypted image map in the deduplication storage.
 3. Themethod as recited in claim 1, wherein the image map is stored in thesource storage.
 4. The method as recited in claim 1, further comprisinga restore phase in which the following steps are performed for eachentry in the image map: hashing, using the second cryptographic hashfunction, the first hash included in the entry to generate the secondhash; searching the key-value table to retrieve the encrypted block ofthe key-value pair having a key that matches the second hash;decrypting, using the encrypt/decrypt function, the encrypted blockusing the first hash as a decryption password; and storing the decryptedblock in a restore storage at the position included in the entry.
 5. Themethod as recited in claim 4, further comprising: encrypting the imagemap subsequent to the backup phase; and decrypting the image map priorto the restore phase.
 6. The method as recited in claim 1, wherein eachof the first cryptographic hash function and the second cryptographichash function is one of a SHA-1, SHA-2, SHA-3, or MD5 cryptographic hashfunction.
 7. The method as recited in claim 1, wherein the firstcryptographic hash function is different from the second cryptographichash function.
 8. The method as recited in claim 1, further comprising:a second backup phase in which the following steps are performed foreach allocated plain text block stored in a second source storage at asecond point in time: hashing, using the first cryptographic hashfunction, the plain text block to generate a fourth hash; hashing, usingthe second cryptographic hash function, the fourth hash to generate afifth hash; searching the key-value table to determine whether the fifthhash matches any key in the key-value table; upon determining that thefifth hash does not match any key in the key-value table, encrypting,using the encrypt/decrypt function, the plain text block using thefourth hash as an encryption password and inserting a key-value pairinto the key-value table with the key being the fifth hash and the valuebeing the encrypted block; and inserting an entry into a second imagemap corresponding to the second source storage that includes the fourthhash and a position of the plain text block in the second sourcestorage.
 9. The method as recited in claim 8, further comprising asecond restore phase in which the following steps are performed for eachentry in the second image map: hashing, using the second cryptographichash function, the fourth hash included in the entry to generate thefifth hash; searching the key-value table to retrieve the encryptedblock of the key-value pair having a key that matches the fifth hash;decrypting, using the encrypt/decrypt function, the encrypted blockusing the fourth hash as a decryption password; and storing thedecrypted block in a second restore storage at the position included inthe entry.
 10. One or more non-transitory computer-readable mediastoring one or more programs that causes one or more processors toexecute the method as recited in claim
 1. 11. A method for client-sideencryption in a deduplication backup system, the method comprising: abackup phase in which the following steps are performed for eachallocated plain text block stored in a source storage at a point intime: hashing, using a first cryptographic hash function, the plain textblock to generate a first hash; encrypting, using an encrypt/decryptfunction, the plain text block using the first hash as an encryptionpassword; hashing, using a second cryptographic hash function, theencrypted block to generate a third hash; searching a key-value table ofa deduplication storage to determine whether the third hash matches anykey in the key-value table, each key-value pair in the key-value tableincluding a key that is a hash and a value that is an encrypted block;upon determining that the third hash does not match any key in thekey-value table, inserting a key-value pair into the key-value tablewith the key being the third hash and the value being the encryptedblock; and inserting an entry into an image map corresponding to thesource storage that includes the first hash, the third hash, and aposition of the plain text block as stored in the source storage. 12.The method as recited in claim 11, further comprising: encrypting theimage map; and storing the encrypted image map in the deduplicationstorage.
 13. The method as recited in claim 11, wherein the image map isstored in the source storage.
 14. The method as recited in claim 11,further comprising a restore phase in which the following steps areperformed for each entry in the image map: searching the key-value tableto retrieve the encrypted block of the key-value pair having a key thatmatches the third hash included in the entry; decrypting, using theencrypt/decrypt function, the encrypted block using the first hash as adecryption password; and storing the decrypted block in a restorestorage at the position included in the entry.
 15. The method as recitedin claim 15, further comprising: encrypting the image map subsequent tothe backup phase; and decrypting the image map prior to the restorephase.
 16. The method as recited in claim 11, wherein each of the firstcryptographic hash function and the second cryptographic hash functionis one of a SHA-1, SHA-2, SHA-3, or MD5 cryptographic hash function. 17.The method as recited in claim 11, wherein the first cryptographic hashfunction is the same as the second cryptographic hash function.
 18. Themethod as recited in claim 11, further comprising: a second backup phasein which the following steps are performed for each allocated plain textblock stored in a second source storage at a second point in time:hashing, using the first cryptographic hash function, the plain textblock to generate a fourth hash; encrypting, using the encrypt/decryptfunction, the plain text block using the fourth hash as an encryptionpassword; hashing, using the second cryptographic hash function, theencrypted block to generate a sixth hash; searching a key-value table ofthe deduplication storage to determine whether the sixth hash matchesany key in the key-value table; upon determining that the sixth hashdoes not match any key in the key-value table, inserting a key-valuepair into the key-value table with the key being the sixth hash and thevalue being the encrypted block; and inserting an entry into a secondimage map corresponding to the second source storage that includes thefourth hash, the sixth hash, and a position of the plain text block asstored in the second source storage.
 19. The method as recited in claim18, further comprising a second restore phase in which the followingsteps are performed for each entry in the second image map: searchingthe key-value table to retrieve the encrypted block of the key-valuepair having a key that matches the sixth hash included in the entry;decrypting, using the encrypt/decrypt function, the encrypted blockusing the fourth hash as a decryption password; and storing thedecrypted block in a second restore storage at the position included inthe entry.
 20. One or more non-transitory computer-readable mediastoring one or more programs that causes one or more processors toexecute the method as recited in claim 11.